CVE-2023-31579: Use of Hard-coded Credentials

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token...

GHSA-MQ26-G339-26XF vulnerabilities

Vulnerabilities for packages: jwt-tool...

GHSA-MX47-H5FV-GHWH light-oauth2 missing public key verification

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

light-oauth2 missing public key verification

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-5752 vulnerabilities

Vulnerabilities for packages: jwt-tool...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

Design/Logic Flaw

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

light-oauth2 Trust Management Issue Vulnerability

light-oauth2 is networknt open source a light-4j based fast , lightweight cloud-native OAuth 2.0 authorization microservice . light-oauth2 version 2.1.27 before the existence of a security vulnerability , the vulnerability stems from obtaining the public key without any validation , allowing an...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

PT-2023-23396

Name of the Vulnerable Software and Affected Versions light-oauth2 versions prior to 2.1.27 Description The issue allows attackers to authenticate to the application with a crafted JWT token because the public key is obtained without verification. Recommendations For versions prior to 2.1.27,...

CVE-2023-31580

CVE-2023-31580 affects light-oauth2 (before version 2.1.27). The root cause is that the library obtains the public key without verification, enabling a crafted JWT to authenticate to the application. Impact is authentication bypass for systems relying on this key verification. Remediation per ava...

CVE-2023-31580: Improper Certificate Validation

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

D-Link D-View 8 Hard-coded JWT Key (CVE-2023-5074)

Binary data dlinkdview8staticjwtkey.nbin...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, py3-tensorflow-serving-api, kubeflow-jupyter-web-app, az, kubeflow-volumes-web-app, py3-cassandra-medusa, jwt-tool, py3-pipenv...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.2, kubeflow-volumes-web-app, k8s-sidecar, jwt-tool, kubeflow-katib, request-1276, nvidia-nsight-compute-13.1, py3-tensorflow-serving-api, py3.13-scanner-test-libraries, py3-cassandra-medusa, py3-pipenv, kubeflow-jupyter-web-app, az...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, py3-tensorflow-serving-api, kubeflow-jupyter-web-app, az, kubeflow-volumes-web-app, py3-cassandra-medusa, jwt-tool, py3-pipenv...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.2, kubeflow-volumes-web-app, k8s-sidecar, jwt-tool, kubeflow-katib, request-1276, nvidia-nsight-compute-13.1, py3-tensorflow-serving-api, py3.13-scanner-test-libraries, py3-cassandra-medusa, py3-pipenv, kubeflow-jupyter-web-app, az...